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1.Which of the following Statements about macros is true? (select all that apply) 

A. Arguments are defined at execution time. 

B. Arguments are defined when the macro is created. 

C. Argument values are used to resolve the search string at execution time. 

D. Argument values are used to resolve the search string when the macro is created. 
Answer: B, C 

Explanation: 

A macro is a way to save a commonly used search string as a variable that you can 
reuse in other searches1. When you create a macro, you can define arguments that 
are placeholders for values that you specify at execution time1. The argument values 
are used to resolve the search string when the macro is invoked, not when it is 
created1. Therefore, statements B and C are true, while statements A and D are 


false. 5 
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2.What is required for a macro to accept three arguments? Ra 
A. The macro's name ends with (3). a0 
B. The macro's name starts with (3). $ 


nti O 
C. The macro's argument count setting is 3 or more. & 
; 9 
D. Nothing, all macros can accept any number of afguments. 


Answer: A ey 

Explanation: È 

To create a macro that accepts argumentgyou must include the number of 
arguments in parentheses at the end g&the macro name1. For example, my_macro(3) 


is a macro that accepts three arguments. The number of arguments in the macro 
name must match the number of uments in the definition1. Therefore, option A is 


correct, while options B, C angi are incorrect. 
N 
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3.Which of the following statements describes POST workflow actions? 
A. POST workflow ations are always encrypted. 
B. POST workflow actions cannot use field values in their URI. 
C. POST workffow actions cannot be created on custom sourcetypes. 
D. POST workflow actions can open a web page in either the same window or a new. 
Answer: D 
Explanation: 
A workflow action is a link that appears when you click an event field value in your 
search results1. A workflow action can open a web page or run another search based 
on the field value1. There are two types of workflow actions: GET and POST1. A GET 
workflow action appends the field value to the end of a URI and opens it in a web 
browser1. A POST workflow action sends the field value as part of an HTTP request 
to a web server1. You can configure a workflow action to open a web page in either 
the same window or a new window1. Therefore, option D is correct, while options A, B 


and C are incorrect. 


4.Which of the following searches show a valid use of macro? (Select all that apply) 
A. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _ time 
newField 

B. index=main source=mySource oldField=* | stats if('makeMyField(oldField)’) | table 
_time newField 

C. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| 
table _ time newField 

D. index=main source=mySource oldField=* | "newField(‘makeMyField(oldField)')" | 
table _time newField 


Answer: A, C F- 

Explanation: ev 

Reference: https://answers.splunk.com/answers/574643/field-shgving-an-additional- 
and-not-visible-value-1.html Rd 


To use a macro in a search, you must enclose the macro Ate and any arguments in 
single quotation marks1. For example, 'my_macro(arg1 afg2)' is a valid way to use a 
macro with two arguments. You can use macros anywhere in your search string 
where you would normally use a search comman D expression1. Therefore, options 
A and C are valid searches that use macros, while options B and D are invalid 
because they do not enclose the macros in sifigle quotation marks. 


Ca 
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5.Which of the following workflow agtions can be executed from search results? 
(select all that apply) oad 
A. GET sy 
B. POST a 
C. LOOKUP ey 
D. Search + 


Answer: A, B, D S 

Explanation: 

As mentioned Before, there are two types of workflow actions: GET and POST1. Both 
types of workflow actions can be executed from search results by clicking on an event 
field value that has a workflow action configured for it1. Another type of workflow 
action is Search, which runs another search based on the field value1. Therefore, 
options A, B and D are correct, while option C is incorrect because LOOKUP is not a 
type of workflow action. 


6.Which of the following is the correct way to use the data model command to search 
field in the data model within the web dataset? 
A. | datamodel web search | filed web * 


B. | Search datamodel web web | filed web* 

C. | datamodel web web field | search web* 

D. Datamodel=web | search web | filed web* 

Answer: A 

Explanation: 

The data model command allows you to run searches on data models that have been 
accelerated1. The syntax for using the data model command is | datamodel 
<model_name> <dataset_name> [search <search_string>]1. Therefore, option A is 
the correct way to use the data model command to search fields in the data model 
within the web dataset. Options B and C are incorrect because they do not follow the 
syntax for the data model command. Option D is incorrect because it does not use the 
data model command at all. 
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7.Which of the following searches will return events contains a tag*name Privileged? 
A. Tag= Priv Ra 
B. Tag= Pri* © 
C. Tag= Priv* 
D. Tag= Privileged Ag 
Answer: B 4^ 
Explanation: g~ 
Reference: È 
https://docs.splunk.com/Documentation/PGH4.1 .O/Install/PrivilegedUserActivity 
A tag is a descriptive label that you candipply to one or more fields or field values in 
your events1. You can use tags to simplify your searches by replacing long or 
complex field names or values wif short and simple tags1. To search for events that 
contain a tag name, you can yge the tag keyword followed by an equal sign and the 
tag name. You can also u A Wildcards (*) to match partial tag names1. Therefore, 
option B is correct because it will return events that contain a tag name that starts 
with Pri. Options A aig are incorrect because they will only return events that 
contain an exact tagshame match. Option C is incorrect because it will return events 
that contain a aan that starts with Priv, not Privileged. 


8.Which of the following statements describes this search? 

sourcetype=access_ combined | transaction JSESSIONID | timechart avg (duration) 
A. This is a valid search and will display a timechart of the average duration, of each 
transaction event. 

B. This is a valid search and will display a stats table showing the maximum pause 
among transactions. 

C. No results will be returned because the transaction command must include the 
startswith and endswith options. 

D. No results will be returned because the transaction command must be the last 


command used in the search pipeline. 

Answer: A 

Explanation: 

This search uses the transaction command to group events that share a common 
value for JSESSIONID into transactions1. The transaction command assigns a 
duration field to each transaction, which is the difference between the latest and 
earliest timestamps of the events in the transaction1. The search then uses the 
timechart command to create a time-series chart of the average duration of each 
transaction1. Therefore, option A is correct because it describes the search 
accurately. Option B is incorrect because the search does not use the stats command 
or the pause field. Option C is incorrect because the transaction command does not 
require the startswith and endswith options, although they can be used to specify how 
to identify the beginning and end of a transaction1. Option D is incorregt because the 
transaction command does not have to be the last command in the.géarch pipeline, 
although it is often used near the end of a search1. 
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9.Calculated fields can be based on which of the following’? 
A. Tags oy 
B. Extracted fields e 


C. Output fields for a lookup A 
D. Fields generated from a search string È 
Answer: B 9? 

oe 
Explanation: ae 
Reference: ` 
https://docs.splunk.com/Documention/Splunk/8.0.3/Knowledge/definecalcfields 
A calculated field is a field thatyyou create based on the value of another field or 
fields1. You can use calculaféd fields to enrich your data with additional information or 
to transform your data iniéva more useful format1. Calculated fields can be based on 
extracted fields, whichsare fields that are extracted from your raw data using various 

S : o ; 

methods such as regular expressions, delimiters, or key-value pairs1. Therefore, 
option B is corregé, while options A, C and D are incorrect because tags, output fields 
for a lookup, afd fields generated from a search string are not types of extracted 
fields. 


10.Based on the macro definition shown below, what is the correct way to execute the 
macro in a search string? 


Name * 
Enter the name of the macro. If the search macro takes an argument, indicate this by appending 
the number of arguments to the name. For example: mymacro(2) 


convert_sales(3) 


Definition * 
Enter the string the search macro expands to when it is referenced in another search. If arguments 
are included, enclose them in dollar signs. For example: Sarg1$ 


stats sum(price) as USD by product name 
| eval S$currencyS="Ssymbol$".tostring (round(USDxS$rate$,2), 
"commas") | eval USD="$" + tostring (USD, "commas") 


Use eval-based definition? 


Arguments 
Enter a comma-delimited string of argument names. Argument names may only contain 
alphanumeric, '_' and '-' characters. 


currency,symbol,rate 


x 
ov 

A. Convert_sales (euro, , 79)” fox 

B. Convert_sales (euro, , .79) wy 

C. Convert_sales ($euro,$$,s79$ È 

D. Convert_sales ($euro, $$,S,79$) Ka 

Answer: B Fa 

Explanation: RY 

Reference: E 


Cà 
https://docs.splunk.com/Docurgehtation/Splunk/8.0.3/Knowledge/Usesearchmacros 
The correct way to execute tè macro in a search string is to use the format 
macro_name($arg1$, „~ 

$arg2$, ...) where $argt$, $arg2$, etc. are the arguments for the macro. In this case, 
the macro name is Shvert_sales and it takes three arguments: currency, symbol, and 
rate. The argumeftts are enclosed in dollar signs and separated by commas. 
Therefore, the €orrect way to execute the macro is convert_sales($euro$, $$, .79). 


11.When multiple event types with different color values are assigned to the same 
event, what determines the color displayed for the events? 

A. Rank 

B. Weight 

C. Priority 

D. Precedence 

Answer: C 

Explanation: 


Reference: 
httos://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Knowledge/Defineeve 
nttypes When multiple event types with different color values are assigned to the 
same event, the color displayed for the events is determined by the priority of the 
event types. The priority is a numerical value that indicates how important an event 
type is. The higher the priority, the more important the event type. The event type with 
the highest priority will determine the color of the event. 


12.Which of the following statements describes the command below (select all that 
apply) 
Sourcetype=access_ combined | transaction JSESSIONID 
A. An additional filed named maxspan is created. 
B. An additional field named duration is created. ve 
C. An additional field named eventcount is created. sf 
D. Events with the same JSESSIONID will be grouped togethgFinto a single event. 
Answer: B, C, D a7 
Explanation: rs 
The command sourcetype=access_ combined | transgetion JSESSIONID does three 
things: 
It filters the events by the sourcetype access ted which is a predefined 
sourcetype for Apache web server logs. È 
It groups the events by the field ee which is a unique identifier for each 
user session. 
It creates a single event from each dip of events that share the same JSESSIONID 
value. This single event will eek me additional fields created by the transaction 
command, such as duration tcount, and startime. 
Therefore, the statements Be and D are true. 
R 
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13.Which of the oe can be used with the eval command tostring function (select 
all that apply) 
A. “hex” 
B. “commas” 
C. “Decimal” 
D. “duration” 
Answer: A, B, D 
Explanation: 
https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/ConversionFu 
nctions#tostring.28X.2CY.29 
The tostring function in the eval command converts a numeric value to a string value. 
It can take an optional second argument that specifies the format of the string value. 
Some of the possible formats are: 


hex: converts the numeric value to a hexadecimal string. 

commas: adds commas to separate thousands in the numeric value. 

duration: converts the numeric value to a human-readable duration string, such as 
“2h 3m 4s”. 

Therefore, the formats A, B, and D can be used with the tostring function. 


14.Which of the following statements about tags is true? 
A. Tags are case insensitive. 
B. Tags are created at index time. 
C. Tags can make your data more understandable. 
D. Tags are searched by using the syntax tag: : <fieldneme> 
Answer: C 2 
Explanation: RS 
Tags are aliases or alternative names for field values in Splunk. Fey can make your 
data more understandable by using common or descriptive tegfis instead of cryptic or 
technical terms. For example, you can tag a field value su Às “200” with “Ok” or 
“success” to indicate that it is a HTTP status code for a goftcessful request. Tags are 
case sensitive, meaning that “OK” and “ok” are different tags. Tags are created at 
search time, meaning that they are applied when you run a search on your data. Tags 
are searched by using the syntax tag::<tagnames, where <tagname> is the name of 
the tag you want to search for. we 
Ca 
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15.Which of the following statementgaibout data models and pivot are true? (select all 
that apply) E 
A. They are both knowledge ofjects. 
B. Data models are created but of datasets called pivots. 
C. Pivot requires users taput SPL searches on data models. 
D. Pivot allows the creation of data visualizations that present different aspects of a 
data model. S 
Answer: D oe 
Explanation: 
Data models and pivot are both knowledge objects in Splunk that allow you to analyze 
and visualize your data in different ways. Data models are collections of datasets that 
represent your data in a structured and hierarchical way. Data models define how 
your data is organized into objects and fields. Pivot is a user interface that allows you 
to create data visualizations that present different aspects of a data model. Pivot does 
not require users to input SPL searches on data models, but rather lets them select 
options from menus and forms. Data models are not created out of datasets called 
pivots, but rather pivots are created from datasets in data models. 


16.When using the Field Extractor (FX), which of the following delimiters will work? 
(select all that apply) 

A. Tabs 

B. Pipes 

C. Colons 

D. Spaces 

Answer: A, B, D 

Explanation: 

Reference: 
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodste 
p 

httos://community.splunk.com/t5/Splunk-Search/Field-Extraction-Separate-on- 
Colon/m-p/29751 5 

The Field Extractor (FX) is a tool that helps you extract fields from úr data using 
delimiters or regular expressions. Delimiters are characters or E s separate 


fields in your data. Ra 
Some of the delimiters that will work with FX are: © 

J 
Tabs: horizontal spaces that align text in columns. K 


Pipes: vertical bars that often indicate logical OR operations. 
Spaces: blank characters that separate words or Mbols. 
Therefore, the delimiters A, B, and D will work wath FX. 

> 


x2 
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17.Which of the following describes the Splunk Common Information Model (CIM) add- 
on? $ 
A. The CIM add-on uses machingdŠarning to normalize data. 
B. The CIM add-on contains dashboards that show how to map data. 
C. The CIM add-on contains™Ñata models to help you normalize data. 
D. The CIM add-on is automatically installed in a Splunk environment. 
Answer: C + 
Explanation: = 
The Splunk Comon Information Model (CIM) add-on is a Splunk app that contains 
data models tohelp you normalize data from different sources and formats. The CIM 
add-on defines a common and consistent way of naming and categorizing fields and 
events in Splunk. This makes it easier to correlate and analyze data across different 
domains, such as network, security, web, etc. The CIM add-on does not use machine 
learning to normalize data, but rather relies on predefined field names and values. 
The CIM add-on does not contain dashboards that show how to map data, but rather 
provides documentation and examples on how to use the data models. The CIM add- 
on is not automatically installed in a Splunk environment, but rather needs to be 
downloaded and installed from Splunkbase. 


18.What does the transaction command do? 

A. Groups a set of transactions based on time. 

B. Creates a single event from a group of events. 

C. Separates two events based on one or more values. 

D. Returns the number of credit card transactions found in the event logs. 

Answer: B 

Explanation: 

The transaction command is a search command that creates a single event from a 
group of events that share some common characteristics. The transaction command 
can group events based on fields, time, or both. The transaction command can also 
create some additional fields for each transaction, such as duration, eventcount, 
startime, etc. The transaction command does not group a set of transactions based 
on time, but rather groups a set of events into a transaction based on time. The 
transaction command does not separate two events based on one gnore values, 
but rather joins multiple events based on one or more values. The Yransaction 
command does not return the number of credit card transactigs found in the event 
logs, but rather creates transactions from the events that méich the search criteria. 


ge 
ov 
19.Which of the following statements describe data"nodel acceleration? (select all 
that apply) ey 
A. Root events cannot be accelerated. È 


B. Accelerated data models cannot be edited. 
C. Private data models cannot be accelerated. 
D. You must have administrative perniissions or the accelerate_dacamodel capability 


to accelerate a data model. Fea 
Answer: B, C, D Ra 

; O 
Explanation: » 


Data model acceleration a feature that speeds up searches on data models by 
creating and storing summaries of the data model datasets1. To enable data model 
acceleration, you mest have administrative permissions or the accelerate_datamodel 
capability 1. Therefore, option D is correct. Accelerated data models cannot be edited 
unless you dis&ble the acceleration first1. Therefore, option B is correct. Private data 
models cannot be accelerated because they are not visible to other users1. 
Therefore, option C is correct. Root events can be accelerated as long as they are not 
based on a search string1. Therefore, option A is incorrect. 


20.A user wants to convert numeric field values to strings and also to sort on those 
values. 

Which command should be used first, the eval or the sort? 

A. It doesn't matter whether eval or sort is used first. 

B. Convert the numeric to a string with eval first, then sort. 


C. Use sort first, then convert the numeric to a string with eval. 

D. You cannot use the sort command and the eval command on the same field. 
Answer: C 

Explanation: 

The eval command is used to create new fields or modify existing fields based on an 
expression2. The sort command is used to sort the results by one or more fields in 
ascending or descending order2. If you want to convert numeric field values to strings 
and also sort on those values, you should use the sort command first, then use the 
eval command to convert the values to strings2. This way, the sort command will use 
the original numeric values for sorting, rather than the converted string values which 
may not sort correctly. Therefore, option C is correct, while options A, B and D are 
incorrect. 
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21.The Field Extractor (FX) is used to extract a custom field. A report can be created 
using this custom field. The created report can then be shareqaWith other people in 
the organization. Ka 
If another person in the organization runs the shared report and no results are 
returned, why might this be? (select all that apply) Ñ 


A. Fast mode is enabled. 4^ 

B. The dashboard is private. A 

C. The extraction is private- È 

D. The person in the organization running te report does not have access to the 
index. ae 

Answer: C, D CY 

Explanation: ra 


The Field Extractor (FX) is a tooffhat helps you extract fields from your events using a 
graphical interface2. You c Ncreate a report using a custom field extracted by the FX 
and share it with other users in your organization2. However, if another user runs the 
shared report and no sults are returned, there could be two possible reasons. One 
reason is that the extraction is private, which means that only you can see and use 
the extracted fie|d2. To make the extraction available to other users, you need to 
make it global 6r app-level2. Therefore, option C is correct. Another reason is that the 
other user does not have access to the index where the events are stored2. To fix this 
issue, you need to grant the appropriate permissions to the other user for the index2. 
Therefore, option D is correct. Options A and B are incorrect because they are not 
related to the field extraction or the report. 


22.Which of the following data model are included In the Splunk Common Information 
Model (CIM) add-on? (select all that apply) 

A. Alerts 

B. Email 


C. Database 
D. User permissions 
Answer: A, B, C 
Explanation: 
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview 
The Splunk Common Information Model (CIM) add-on is a collection of pre-built data 
models and knowledge objects that help you normalize your data from different 
sources and make it easier to analyze and report on it8. The CIM add-on includes 
several data models that cover various domains such as Alerts, Email, Database, 
Network Traffic, Web and more3. Therefore, options A, B and C are correct because 
they are names of some of the data models included in the CIM add-on. Option D is 
incorrect because User permissions is not a name of a data model in the CIM add-on. 
2 

ve 
23.A field alias has been created based on an original field. A sealh without any 
transforming commands is then executed in Smart Mode. 8” 
Which field name appears in the results? Ka 
A. Both will appear in the All Fields list, but only if the alia’ is specified in the search. 
B. Both will appear in the Interesting Fields list, but oy if they appear in at least 20 
percent of events. 
C. The original field only appears in All Fields irira the alias only appears in the 
Interesting Fields list. 
D. The alias only appears in the All Fields St and the original field only appears in the 
Interesting Fields list. 
Answer: B Ry 
Explanation: E 
A field alias is a way to ana inae name to an existing field without 
changing the original field aMe or value2. You can use field aliases to make your 
field names more consistent or descriptive across different sources or sourcetypes2. 
When you run a searchwithout any transforming commands in Smart Mode, Splunk 
automatically identif@s and displays interesting fields in your results2. Interesting 
fields are fields tpat appear in at least 20 percent of events or have high variability 
among values® If you have created a field alias based on an original field, both the 
Original field name and the alias name will appear in the Interesting Fields list if they 
meet these criteria2. However, only one of them will appear in each event depending 
on which one you have specified in your search string2. Therefore, option B is correct, 
while options A, C and D are incorrect. 


24.When performing a regular expression (regex) field extraction using the Field 
Extractor (FX), what happens when the require option is used? 

A. The regex can no longer be edited. 

B. The field being extracted will be required for all future events. 


C. The events without the required field will not display in searches. 

D. Only events with the required string will be included in the extraction. 

Answer: D 

Explanation: 

The Field Extractor (FX) allows you to use regular expressions (regex) to extract 
fields from your events using a graphical interface or by manually editing the regex2. 
When you use the FX to perform a regex field extraction, you can use the require 
option to specify a string that must be present in an event for it to be included in the 
extraction2. This way, you can filter out events that do not contain the required string 
and focus on the events that are relevant for your extraction2. Therefore, option D is 
correct, while options A, B and C are incorrect. 


25.Which group of users would most likely use pivots? Ka 
A. Users 
B. Architects O° 
C. Administrators eo 
D. Knowledge Managers 
Answer: A AZ 
Explanation: 4^ 
Reference: gK 
https://docs.splunk.com/Documentation/Splygk/8.0.3/Pivot/IntroductiontoPivot 
A pivot is a tool that allows you to create r@ports and dashboards using data models 
without writing any SPL commands2. You can use pivots to explore, filter, split and 
visualize your data using a graphical nterface2. Pivots are designed for users who 
want to analyze and report on thgjrdata without having to learn the SPL syntax or the 
underlying structure of the data2. Therefore, option A is correct, while options B, C 
and D are incorrect because'they are not the typical group of users who would use 
pivots. A 
w$ 
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26.When using tfechart, how many fields can be listed after a by clause? 
A. because timẹchart doesn't support using a by clause. 
B. because _time is already implied as the x-axis. 
C. because one field would represent the x-axis and the other would represent the y- 
axis. 
D. There is no limit specific to timechart. 
Answer: B 
Explanation: 
The timechart command is used to create a time-series chart of statistical values 
based on your search results2. You can use the timechart command with a by clause 
to split the results by one or more fields and create multiple series in the chart2. 
However, you can only list one field after the by clause when using the timechart 


command because _ time is already implied as the x-axis of the chart2. Therefore, 
option B is correct, while options A, C and D are incorrect. 


27.What is the correct syntax to search for a tag associated with a value on a specific 
fields? 

A. Tag-<field? 

B. Tag<filed(tagname.) 

C. Tag=<filed>::<tagname> 

D. Tag::<filed>=<tagname> 


Answer: D 

Explanation: 

Reference: 

https://docs.splunk.com/Documentation/Splunk/8.0. SiKnowledge/Tagindaliasteldvalu 
esinSplunkW eb gf 


A tag is a descriptive label that you can apply to one or more {ids or field values in 
your events2. You can use tags to simplify your searches b¥replacing long or 
complex field names or values with short and simple tags2. To search for a tag 
associated with a value on a specific field, you can use he following syntax: 
tag::<field>=<tagname>2. For example, tag::statu rror will search for 
events where the status field has a tag named grror. Therefore, option D is correct, 
while options A, B and C are incorrect because they do not follow the correct syntax 
for searching tags. Ka 
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28.What functionality does the S fik Common Information Model (CIM) rely on to 
normalize fields with different K es? 
A. Macros. 4^ 
B. Field aliases. @ 
C. The rename command. 
D. CIM does not wok with different names for the same field. 
Answer: B oe 
Explanation: 
The Splunk Common Information Model (CIM) add-on helps you normalize your data 
from different sources and make it easier to analyze and report on it3. One of the 
functionalities that the CIM add-on relies on to normalize fields with different names is 
field aliases3. Field aliases allow you to assign an alternative name to an existing field 
without changing the original field name or value2. By using field aliases, you can 
map different field names from different sources or sourcetypes to a common field 
name that conforms to the CIM standard3. Therefore, option B is correct, while 
options A, C and D are incorrect. 


29.When should you use the transaction command instead of the scats command? 
A. When you need to group on multiple values. 
B. When duration is irrelevant in search results.. 
C. When you have over 1000 events in a transaction. 
D. When you need to group based on start and end constraints. 
Answer: D 
Explanation: 
The transaction command is used to group events into transactions based on some 
common characteristics, such as fields, time, or both. The transaction command can 
also specify start and end constraints for the transactions, such as a field value that 
indicates the beginning or the end of a transaction. The stats command is used to 
calculate summary statistics on the events, such as count, sum, average, etc. The 
stats command cannot group events based on start and end constraints, but only on 
fields or time buckets. Therefore, the transaction command should be used instead of 
the stats command when you need to group events based on staand end 
constraints. O° 
o 
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30.Which of the following statements describes field aliases? 
A. Field alias names replace the original field na $ 
B. Field aliases can be used in lookup file definiġöns. 
C. Field aliases only normalize data across sgurces and sourcetypes. 
D. Field alias names are not case sensitiveWwhen used as part of a search. 
Answer: B Py 

: K 
Explanation: $ 
Field aliases are alternative namegYor fields in Splunk. Field aliases can be used to 
normalize data across differentisources and sourcetypes that have different field 
names for the same conceptsFor example, you can create a field alias for src_ip that 
maps to clientip, source_@ddress, or any other field name that represents the source 

Sa © h 

IP address in differentsourcetypes. Field aliases can also be used in lookup file 
definitions to map fieids in your data to fields in the lookup file. For example, you can 
use a field alias {ot src_ip to map it to ip_address in a lookup file that contains 
geolocation information for IP addresses. Field alias names do not replace the original 
field name, but rather create a copy of the field with a different name. Field alias 
names are case sensitive when used as part of a search, meaning that src_ip and 
SRC_IP are different fields. 


31.What does the following search do? 


andex=cor: cy j i rndoq count’ by user 


A. Creates a table of the total count of users and split by corndogs. 


B. Creates a table of the total count of mysterymeat corndogs split by user. 
C. Creates a table with the count of all types of corndogs eaten split by user. 
D. Creates a table that groups the total number of users by vegetarian corndogs. 
Answer: B 
Explanation: 
The search string below creates a table of the total count of mysterymeat corndogs 
split by user. | stats count by user | where corndog=mysterymeat 
The search string does the following: 
It uses the stats command to calculate the count of events for each value of the user 
field. The stats command creates a table with two columns: user and count. 
It uses the where command to filter the results by the value of the corndog field. The 
where command only keeps the rows where corndog equals mysterymeat. 
Therefore, the search string creates a table of the total count of mysterymeat 
corndogs split by user. Ss 

é 
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32.Which of the following statements describes Search worktlow actions? 
A. By default. Search workflow actions will run as a rea 4e search. 
B. Search workflow actions can be configured as F searches, 
C. The user can define the time range of the seargttwhen created the workflow 


action. ev 
O 
D. Search workflow actions cannot be configured with a search string that includes 
the transaction command 9? 
oe 
Answer: C we 
Explanation: O 


Search workflow actions are custgeh actions that run a search when you click on a 
field value in your search results. Search workflow actions can be configured with 
various options, such as lage? name, search string, time range, app context, etc. One 
of the options is to defingge time range of the search when creating the workflow 
action. You can en eee predefined time ranges, such as Last 24 hours, Last 7 
days, etc., or specify’ custom time range using relative or absolute time modifiers. 
Search workflowictions do not run as real-time searches by default, but rather use 
the same time fange as the original search unless specified otherwise. Search 
workflow actions cannot be configured as scheduled searches, as they are only 
triggered by user interaction. Search workflow actions can be configured with any 
valid search string that includes any search command, such as transaction. 


33.What do events in a transaction have In common? 

A. All events In a transaction must have the same timestamp. 

B. All events in a transaction must have the same sourcetype. 

C. All events in a transaction must have the exact same set of fields. 
D. All events in a transaction must be related by one or more fields. 


Answer: D 

Explanation: 

Reference: 
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Abouttransactions 
A transaction is a group of events that share some common characteristics, such as 
fields, time, or both. A transaction can be created by using the transaction command 
or by defining an event type with transactiontype=true in props.conf. Events in a 
transaction have one or more fields in common that relate them to each other. For 
example, you can create a transaction based on JSESSIONID, which is a unique 
identifier for each user session in web logs. Events in a transaction do not have to 
have the same timestamp, sourcetype, or exact same set of fields. They only have to 
share one or more fields that define the transaction. 

Ká 

34.Which of the following statements describe GET workflow actishs? 
A. GET workflow actions must be configured with POST argum€nts. 

B. Configuration of GET workflow actions includes choosing’ sourcetype. 

C. Label names for GET workflow actions must include afield name surrounded by 


dollar signs. AZ 

D. GET workflow actions can be configured to opedthe URT link in the current 
window or in a new window A 

Answer: D È 

Explanation: 9? 


GET workflow actions are custom actigg® that open a URL link when you click on a 
field value in your search results. GẸF workflow actions can be configured with 
various options, such as label nat , base URL, URI parameters, app context, etc. 
One of the options is to choosgwhether to open the URL link in the current window or 
in a new window. GET workftéw actions do not have to be configured with POST 
arguments, as they use method to send requests to web servers. Configuration 
of GET workflow actiogs does not include choosing a sourcetype, as they do not 
generate any data i@’Splunk. Label names for GET workflow actions must include a 
field name surroAded by dollar signs, as this indicates the field value that will be 
used to replacé the variable in the URL link. 


35.Data model are composed of one or more of which of the following datasets? 
(select all that apply.) 

A. Events datasets 

B. Search datasets 

C. Transaction datasets 

D. Any child of event, transaction, and search datasets 

Answer: A, B, C 

Explanation: 


Reference: 
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels 
Data models are collections of datasets that represent your data in a structured and 
hierarchical way. Data models define how your data is organized into objects and 
fields. Data models can be composed of one or more of the following datasets: 
Events datasets: These are the base datasets that represent raw events in Splunk. 
Events datasets can be filtered by constraints, such as search terms, sourcetypes, 
indexes, etc. 

Search datasets: These are derived datasets that represent the results of a search on 
events or other datasets. Search datasets can use any search command, such as 
stats, eval, rex, etc., to transform the data. 

Transaction datasets: These are derived datasets that represent groups of events that 
are related by fields, time, or both. Transaction datasets can use the transaction 
command or event types with transactiontype=true to create transagtfons. 


$ 
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36.Which are valid ways to create an event type? (select alat apply) 


A. By using the searchtypes command in the search ban 
B. By editing the event_type stanza in the props.contfile. 
C. By going to the Settings menu and clicking Ev nt Types > New. 

D. By selecting an event in search results and oli ing Event Actions > Build Event 


Type. È 
Answer: C, D 3? 

oe 
Explanation: 


% 


types can be used to label eventswith meaningful names, such as error, Success, 
login, logout, etc. Event types gan also be used to create transactions, alerts, reports, 
dashboards, etc. Event typ van be created in two ways: 

By going to the Settings ênu and clicking Event Types > New. This will open a form 
where you can enter tae name, description, search string, app context, and tags for 
the event type. = 
By selecting an event in search results and clicking Event Actions > Build Event Type. 
This will open 8 dialog box where you can enter the name and description for the 
event type. The search string will be automatically populated based on the selected 
event. 

Event types cannot be created by using the searchtypes command in the search bar, 
as this command does not exist in Splunk. Event types can also be created by editing 
the event_type stanza in the transforms.conf file, not the props.conf file. 


es 
Event types are custom categories “i that are based on search criteria. Event 


37.Which of the following statements describe the search string below? 
| datamodel Application State All_ Application_State search 
A. Evenrches would return a report of sales by state. 


B. Events will be returned from the data model named Application_State. 
C. Events will be returned from the data model named All_ Application_ state. 
D. No events will be returned because the pipe should occur after the datamodel 
command 
Answer: B 
Explanation: 
The search string below returns events from the data model named 
Application_State. 
| datamodel Application State All_ Application_State search 
The search string does the following: 
It uses the datamodel command to access a data model in Splunk. The datamodel 
command takes two arguments: the name of the data model and the name of the 
dataset within the data model. It specifies the name of the data model as 
Application_State. This is a predefined data model in Splunk that catfains information 
about web applications. sf 
It specifies the name of the dataset as All_Application_State. Bais is a root dataset in 
the data model that contains all events from all child datasefé. 
It uses the search command to filter and transform the nts from the dataset. The 
search command can use any search criteria or command to modify the results. 
Therefore, the search string returns events from the'data model named 
Application_ State. A 

$ 
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38.What is the relationship between dat models and pivots? 
A. Data models provide the datasets6r pivots. 
B. Pivots and data models have perrelationship. 
C. Pivots and data models areghe same thing. 
D. Pivots provide the datasets for data models. 
Answer: A K 
Explanation: + 
The relationship between data models and pivots is that data models provide the 
datasets for pivots. Data models are collections of datasets that represent your data 
in a structured 4nd hierarchical way. Data models define how your data is organized 
into objects and fields. Pivots are user interfaces that allow you to create data 
visualizations that present different aspects of a data model. Pivots let you select 
options from menus and forms to create charts, tables, maps, etc., without writing any 
SPL code. Pivots use datasets from data models as their source of data. Pivots and 
data models are not the same thing, as pivots are tools for visualizing data models. 
Pivots do not provide datasets for data models, but rather use them as inputs. 
Therefore, only statement A is true about the relationship between data models and 
pivots. 


39.What are the two parts of a root event dataset? 
A. Fields and variables. 
B. Fields and attributes. 
C. Constraints and fields. 
D. Constraints and lookups. 
Answer: C 
Explanation: 
Reference: https://docs.splunk.com/Documentation/SplunkLight/7.3.5/GettingStarted/ 
Designdatamodelobjects 
A root event dataset is the base dataset for a data model that defines the source or 
sources of the data and the constraints and fields that apply to the data1. A root event 
dataset has two parts: constraints and fields1. Constraints are filters that limit the data 
to a specific index, source, sourcetype, host or search string1. Fields are the 
attributes that describe the data and can be extracted, calculated otéoked up1. 
Therefore, option C is correct, while options A, B and D are incorgéct. 
© 

o 
40.In which of the following scenarios is an event type mote effective than a saved 
search? sy 
A. When a search should always include the sam Mme range. 
B. When a search needs to be added to other ug&rs' dashboards. 
C. When the search string needs to be used df future searches. 
D. When formatting needs to be included wih the search string. 
Answer: C re 

7 Y 

Explanation: $ 
Reference: htips:/answers.splunkom/answers/4993/eventtype-vs-saved- 
search.html sy 
An event type is a way to cafégorize events based on a search string that matches 
the events2. You can us@xXévent types to simplify your searches by replacing long or 
complex search strings*with short and simple event type names2. An event type is 
more effective thane saved search when the search string needs to be used in future 
searches becaus# it allows you to reuse the search string without having to remember 
or type it again®. Therefore, option C is correct, while options A, B and D are incorrect 
because they are not scenarios where an event type is more effective than a saved 
search. 


41.How does a user display a chart in stack mode? 

A. By using the stack command. 

B. By turning on the Use Trellis Layout option. 

C. By changing Stack Mode in the Format menu. 

D. You cannot display a chart in stack mode, only a timechart. 
Answer: C 


Explanation: 

A chart is a graphical representation of your search results that shows the relationship 
between two or more fields2. You can display a chart in stack mode by changing the 
Stack Mode option in the Format menu2. Stack mode allows you to stack multiple 
series on top of each other in a chart to show the cumulative values of each series2. 
Therefore, option C is correct, while options A, B and D are incorrect because they 
are not ways to display a chart in stack mode. 


42.Which of the following statements about event types is true? (select all that apply) 
A. Event types can be tagged. 

B. Event types must include a time range, 

C. Event types categorize events based on a search. 5 

D. Event types can be a useful method for capturing and sharing knsWledge. 
Answer: A, C, D ae 


(e) 
Explanation: O° 


Reference: https://www.edureka.co/blog/splunk-events-ev &Ètypes-and-tags/ 
As mentioned before, an event type is a way to categorize” events based on a search 
string that matches the events2. Event types can be tagged, which means that you 
can apply descriptive labels to event types and useNhem in your searches2. 
Therefore, option A is correct. Event types categorize events based on a search 
string, which means that you can define an event type by specifying a search string 
that matches the events you want to inclug® in the event type2. Therefore, option C is 
correct. Event types can be a useful meftiod for capturing and sharing knowledge, 
which means that you can use event-ypes to organize your data into meaningful 
categories and share them with gi r users in your organization2. Therefore, option D 
is correct. Event types do not Rave to include a time range, which means that you can 
create an event type withoytSpecifying a time range for the events2. Therefore, 
option B is incorrect. K 
w 
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43.In what ordeņérc the following knowledge objects/configurations applied? 
A. Field Aliaseg, Field Extractions, Lookups 
B. Field Extractions, Field Aliases, Lookups 
C. Field Extractions, Lookups, Field Aliases 
D. Lookups, Field Aliases, Field Extractions 
Answer: B 
Explanation: 
Reference: 
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/WhatisSplunkknowle 
dge 
Knowledge objects are entities that you create to add knowledge to your data and 
make it easier to search and analyze2. Some examples of knowledge objects are field 


extractions, field aliases and lookups2. Field extractions are methods that extract 
fields from your raw data using various techniques such as regular expressions, 
delimiters or key-value pairs2. Field aliases are ways to assign alternative names to 
existing fields without changing the original field names or values2. Lookups are ways 
to enrich your data with additional information from external sources such as CSV 
files or databases2. The order in which these knowledge objects/configurations are 
applied is as follows: field extractions, field aliases and then lookups2. This means 
that Splunk first extracts fields from your raw data, then applies any aliases to the 
extracted fields and then performs any lookups on the aliased fields2. Therefore, 
option B is correct, while options A, C and D are incorrect. 


44.Which of the following knowledge objects represents the output of an eval 

expression? ve 

A. Eval fields * 

B. Calculated fields O° 

C. Field extractions has 

D. Calculated lookups Rs 
9 

Answer: B NA 

Explanation: roy 

Reference: https://docs.splunk.com/Splexicon:Gatculatedfield 

The eval command is used to create new fields or modify existing fields based on an 

expression2. The output of an eval expresgfon is a calculated field, which is a field 

that you create based on the value of apdther field or fields2. You can use calculated 

fields to enrich your data with additional information or to transform your data into a 

more useful format2. Therefore, plor B is correct, while options A, C and D are 

incorrect because they are nokwames of knowledge objects that represent the output 

of an eval expression. » 

Pl 
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45.A calculated fielgnaybe based on which of the following? 

A. Lookup tableg? 

B. Extracted fiélds 

C. Regular expressions 

D. Fields generated within a search string 

Answer: B 

Explanation: 

As mentioned before, a calculated field is a field that you create based on the value of 

another field or fields2. A calculated field can be based on extracted fields, which are 

fields that are extracted from your raw data using various methods such as regular 

expressions, delimiters or key-value pairs2. Therefore, option B is correct, while 

options A, C and D are incorrect because they are not types of fields that a calculated 

field can be based on. 


46.Which of the following eval command function is valid? 

A. Int () 

B. Count ( ) 

C. Print () 

D. Tostring () 

Answer: D 

Explanation: 

The eval command supports a number of functions that you can use in your 
expressions to perform calculations, conversions, string manipulations and more2. 
One of the eval command functions is tostring(), which converts a numeric value to a 
string value2. Therefore, option D is correct, while options A, B and C pre incorrect 


because they are not valid eval command functions. rol 

Ka 
47.Which one of the following statements about the Beaten @mmand i is true? 
A. It does not allow the use of wildcards. Ro 


B. It treats field values in a case-sensitive manner. Ñ% 
C. It can only be used at the beginning of the search pipeline. 
D. It behaves exactly like search strings before the first pipe. 


Answer: D 

Explanation: C 
Q 

Reference: —_ 


https://docs.splunk. com/DocumerigvSpuniCoud .0.2003/Search/Usethesearchc 
ommand 
The search command is er ie or refine your search results based on a search 
string that matches the events2. The search command behaves exactly like search 
strings before the first pipe, which means that you can use the same syntax and 
operators as you woul¢use in the initial part of your search2. Therefore, option D is 
correct, while optiags A, B and C are incorrect because they are not true statements 
about the searche€ommand. 

g 


48.What does the Splunk Common Information Model (CIM) add-on include? (select 
all that apply) 

A. Custom visualizations 

B. Pre-configured data models 

C. Fields and event category tags 

D. Automatic data model acceleration 

Answer: BC 

Explanation: 

The Splunk Common Information Model (CIM) add-on is a collection of pre-built data 


models and knowledge objects that help you normalize your data from different 
sources and make it easier to analyze and report on it8. The CIM add-on includes pre- 
configured data models that cover various domains such as Alerts, Email, Database, 
Network Traffic, Web and more3. Therefore, option B is correct. The CIM add-on also 
includes fields and event category tags that define the common attributes and labels 
for the data models3. Therefore, option C is correct. The CIM add-on does not include 
custom visualizations or automatic data model acceleration. Therefore, options A and 
D are incorrect. 


49.Which of the following file formats can be extracted using a delimiter field 
extraction? 


A. CSV 5 
B. PDF ve 
C. XML gf 

D. JSON Ki 
Answer: A o 


Explanation: ae 


R 
A delimiter field extraction is a method of extracting figlds from data that uses a 
character or a string to separate fields in each ev nif A delimiter field extraction can 
be performed by using the Field Extractor (FX) so or by editing the props.conf file. A 
delimiter field extraction can be applied to anyptile format that uses a delimiter to 
separate fields, such as CSV, TSV, PSV . A CSV file is a comma-separated 
values file that uses commas as delimiters. Therefore, a CSV file can be extracted 
using a delimiter field extraction. a 
<f 
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50.Which of the following s aments describes macros? 
A. A macro is a reusablegearch string that must contain the full search. 
B. A macro is a reusa@le search string that must have a fixed time range. 
C.Amacrolsa reysable search string that may have a flexible time range. 
D. A macro Is a Jéusable search string that must contain only a portion of the search. 
Answer: C 
Explanation: 
Reference: 
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros 
A macro is a reusable search string that can contain any part of a search, such as 
search terms, commands, arguments, etc. A macro can have a flexible time range 
that can be specified when the macro is executed. A macro can also have arguments 
that can be passed to the macro when it is executed. A macro can be created by 
using the Settings menu or by editing the macros.conf file. A macro does not have to 
contain the full search, but only the part that needs to be reused. A macro does not 
have to have a fixed time range, but can use a relative or absolute time range 


modifier. A macro does not have to contain only a portion of the search, but can 
contain multiple parts of the search. 


51.Which of the following statements describe calculated fields? (select all that apply) 
A. Calculated fields can be used in the search bar. 

B. Calculated fields can be based on an extracted field. 

C. Calculated fields can only be applied to host and sourcetype. 

D. Calculated fields are shortcuts for performing calculations using the eval 
command. 

Answer: A, B, D 

Explanation: 

Reference: oe 
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/defifiecalcfields 
Calculated fields are fields that are created by performing calculations on existing 
fields using the eval command. Calculated fields can be used. the search bar to 
filter and transform events based on the calculated values.,@alculated fields can also 
be based on an extracted field, which is a field that is extracted from raw data using 
various methods, such as regex, delimiters, lookups, ic. Calculated fields are not 
shortcuts for performing calculations using the eval’€ommand, but rather results of 
performing calculations using the eval commang: alculated fields can be applied to 
any field in Splunk, not only host and source. 

Therefore, statements A, B, and D are trugâbout calculated fields. 


we 
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52.Which delimiters can the Field &xtractor (FX) detect? (select all that apply) 
A. Tabs RY 
© 
B. Pipes 4^ 
C. Spaces A 


D. Commas S 

Answer: B,C,D <@ 

Explanation: a 

Reference: 
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodste 


The Field Extractor (FX) is a tool that helps you extract fields from your data using 
delimiters or regular expressions. Delimiters are characters or strings that separate 
fields in your data. The FX can detect some common delimiters automatically, such 
as pipes (|), spaces ( ), commas (,), semicolons (;), etc. The FX cannot detect tabs (\t) 
as delimiters automatically, but you can specify them manually in the FX interface. 


53.Which of the following statements is true, especially in large environments? 


A. Use the scats command when you next to group events by two or more fields. 

B. The stats command is faster and more efficient than the transaction command 

C. The transaction command is faster and more efficient than the stats command. 

D. Use the transaction command when you want to see the results of a calculation. 
Answer: B 

Explanation: 

Reference: https://answers.splunk.com/answers/103/transaction-vs-stats- 
commands.html 

The stats command is faster and more efficient than the transaction command, 
especially in large environments. The stats command is used to calculate summary 
statistics on the events, such as count, sum, average, etc. The stats command can 
group events by one or more fields or by time buckets. The stats command does not 
create new events from groups of events, but rather creates new fieldsawith statistical 
values. The transaction command is used to group events into trangattions based on 
some common characteristics, such as fields, time, or both. The jransaction 
command creates new events from groups of events that sharé’one or more fields. 
The transaction command also creates some additional fils for each transaction, 
such as duration, eventcount, startime, etc. The transa tidh command is slower and 
more resource-intensive than the stats command begãuse it has to process more 


data and create more events and fields. rey 
x 
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54.Which of the following are required to çêate a POST workflow action? 
. S 
A. Label, URI, search string. ae 
B. XMI attributes, URI, name. O 


C. Label, URI, post arguments. 4? 
D. URI, search string, time range picker. 
Answer: C © 

+ 
Explanation: A 
POST workflow actiongs-are custom actions that send a POST request to a web server 
when you click on adield value in your search results. POST workflow actions can be 
configured with yatrious options, such as label name, base URL, URI parameters, post 
arguments, app context, etc. One of the options that are required to create a POST 
workflow action is post arguments. Post arguments are key-value pairs that are sent 
in the body of the POST request to provide additional information to the web server. 
Post arguments can include field values from your data by using dollar signs around 
the field names. 


55.Which of the following statements describe the search below? (select all that 
apply) 

Index=main | transaction clientip host maxspan=30s maxpause=5s 

A. Events in the transaction occurred within 5 seconds. 


B. It groups events that share the same clientip and host. 
C. The first and last events are no more than 5 seconds apart. 
D. The first and last events are no more than 30 seconds apart. 
Answer: ABD 
Explanation: 
The search below groups events by two or more fields (clientip and host), creates 
transactions with start and end constraints (maxspan=30s and maxpause=5s), and 
calculates the duration of each transaction. 
index=main | transaction clientip host maxspan=30s maxpause=5s 
The search does the following: 
It filters the events by the index main, which is a default index in Splunk that contains 
all data that is not sent to other indexes. 
It uses the transaction command to group events into transactions bas¢d on two 
fields: clientip and host. The transaction command creates new evens from groups of 
events that share the same clientip and host values. s 
It specifies the start and end constraints for the transactions using the maxspan and 
maxpause arguments. The maxspan argument sets the m simum time span between 
the first and last events in a transaction. The maxpause.afgument sets the maximum 
time span between any two consecutive events in a transaction. In this case, the 
maxspan is 30 seconds and the maxpause is 5 s Mds, meaning that any 
transaction that has a longer time span or pauseWill be split into multiple 
transactions. w 
It creates some additional fields for each saction, such as duration, eventcount, 
startime, etc. The duration field shows {He time span between the first and last events 
in a transaction. . 
P 
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56.Given the macro definiti Nbelow, what should be entered into the Name and 
Arguments fileds to corrgetly configured the macro? 


Destination app 


oidemo — 
Name * 
Enter the name of the macro. If the search macro takes an argument, indicate this by appending the number of arguments to 
Definition * 


Enter the string the search macro expands to when it is referenced in another search. If arguments are included, enclose them 


sourcetype=access combined action=Saction$ JSESSIONID= 
SIJSESSIONIDS 
| stats values(action) as action by JSESSIONID 


Use eval-based definition? 


Arguments 
Enter a comma-delimited string of argument names. Argument names may only contain alphanumeric, '_' and '-' characters. 


c 
S 
A. The macro name is sessiontracker and the argumen R action, JESSIONID. 


B. The macro name is sessiontracker(2) and the arguments are action, JESSIONID. 
C. The macro name is sessiontracker and the arguments are $action$, 


$JESSIONID$. ey 
D. The macro name is sessiontracker(2) andghe Arguments are $action$, 
$JESSIONID$. 9? 
of 
Answer: B > 
Explanation: OX 


Reference: E 

https://docs. splunk.com/Docurgehtation/Splunk/8.0.3/Knowledge/Definesearchmacros 
The macro definition below,sfiows a macro that tracks user sessions based on two 
arguments: action and JSF SIONID. 

sessiontracker(2) + 

The macro definitiggdoes the following: 

It specifies the name of the macro as sessiontracker. This is the name that will be 
used to executé the macro in a search string. 

It specifies the number of arguments for the macro as 2. This indicates that the macro 
takes two arguments when it is executed. 

It specifies the code for the macro as index=main 
sourcetype=access_combined_wcookie 

action=$action$ JSESSIONID=$JSESSIONID$ | stats count by SESSIONID. This is 
the search string that will be run when the macro is executed. The search string can 
contain any part of a search, such as search terms, commands, arguments, etc. The 
search string can also include variables for the arguments using dollar signs around 
them. In this case, action and JSESSIONID are variables for the arguments that will 
be replaced by their values when the macro is executed. 


Therefore, to correctly configure the macro, you should enter sessiontracker as the 
name and action, JSESSIONID as the arguments. Alternatively, you can use 
sessiontracker(2) as the name and leave the arguments blank. 


57.After manually editing; a regular expression (regex), which of the following 
statements is true? 

A. Changes made manually can be reverted in the Field Extractor (FX) UI. 

B. It is no longer possible to edit the field extraction in the Field Extractor (FX) Ul. 

C. It is not possible to manually edit a regular expression (regex) that was created 
using the Field Extractor (FX) UI. 

D. The Field Extractor (FX) Ul keeps its own version of the field extraction in addition 


to the one that was manually edited. 5 
© 

Answer: B RS 

Explanation: a 


After manually editing a regular expression (regex) that was cated using the Field 
Extractor (FX) Ul, it is no longer possible to edit the field e Action in the FX UI. The 
FX Ul is a tool that helps you extract fields from your d tausing delimiters or regular 
expressions. The FX Ul can generate a regex for youseased on your selection of 
sample values or you can enter your own regex i the FX UI. However, if you edit the 
regex manually in the props.conf file, the FX ULavill not be able to recognize the 
changes and will not let you edit the field extraction in the FX Ul anymore. You will 
have to use the props.conf file to make anyurther changes to the field extraction. 
Changes made manually cannot be reyétted in the FX Ul, as the FX UI does not keep 
track of the changes made in the Pad file. It is possible to manually edit a regex 
that was created using the FX Ul a long as you do it in the props.conf file. 


Therefore, only statement B iggwue about manually editing a regex. 
N 
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58.What does the fila command replace null values with, it the value argument is 
not specified? <¢ 
A.0 oe 
B. N/A s 
C. NaN 
D. NULL 
Answer: A 
Explanation: 
Reference: https://answers.splunk.com/answers/653427/fillnull-doesnt-work-without- 
specfying-a-field.html 
The fillnull command is a search command that replaces null values with a specified 
value or 0 if no value is specified. Null values are values that are missing, empty, or 
undefined in Splunk. The fillnull command can replace null values for all fields or for 
specific fields. The fillnull command can take an optional argument called value that 


specifies the value to replace null values with. If no value argument is specified, the 
fillnull command will replace null values with 0 by default. 


59.To identify all of the contributing events within a transaction that contains at least 
one REJECT event, which syntax is correct? 
A. Index-main | REJECT trans sessionid 
B. Index-main | transaction sessionid | search REJECT 
C. Index=main | transaction sessionid | whose transaction=reject 
D. Index=main | transaction sessionid | where transaction=reject”’ 
Answer: B 
Explanation: 
The transaction command is used to group events that share a commgn value for one 
or more fields into transactions2. The transaction command assigng transaction ID 
to each group of events and creates new fields such as duration s@ventcount and 
eventlist for each transaction2. To identify all of the contributing’events within a 
transaction that contains at least one REJECT event, you 4f use the following 
syntax: index=main | transaction sessionid | search RE 2. This search will first 
group the events by sessionid, then filter out the trangactions that do not contain 
REJECT in any of their events2. Therefore, optio Bis correct, while options A, C and 
D are incorrect because they do not follow the gerrect syntax for using the transaction 
command or the search command. È 
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60.Which of the following actions cansthe eval command perform? 
A. Remove fields from results. | .@ 
B. Create or replace an existing feld. 
C. Group transactions by ope or more fields. 
D. Save SPL commandsdo be reused in other searches. 
Answer: B + 
Explanation: = 
The eval commadd is used to create new fields or modify existing fields based on an 
expression2. The eval command can perform various actions such as calculations, 
conversions, string manipulations and more2. One of the actions that the eval 
command can perform is to create or replace an existing field with a new value based 
on an expression2. For example, | eval status=if(status="200","OK","ERROR") will 
create or replace the status field with either OK or ERROR depending on the original 
value of status2. Therefore, option B is correct, while options A, C and D are incorrect 
because they are not actions that the eval command can perform. 


61.Which of the following statements describe the Common Information Model (CIM)? 
(select all that apply) 


A. CIM is a methodology for normalizing data. 

B. CIM can correlate data from different sources. 

C. The Knowledge Manager uses the CIM to create knowledge objects. 

D. CIM is an app that can coexist with other apps on a single Splunk deployment. 
Answer: A, B, C 

Explanation: 

Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview 

The Common Information Model (CIM) is a methodology for normalizing data from 
different sources and making it easier to analyze and report on it3. The CIM defines a 
common set of fields and tags for various domains such as Alerts, Email, Database, 
Network Traffic, Web and mores. One of the statements that describe the CIM is that 
it is a methodology for normalizing data, which means that it provides a standard way 
to name and structure data from different sources so that they can be gompared and 
correlated3. Therefore, option A is correct. Another statement that déScribes the CIM 
is that it can correlate data from different sources, which means pat it enables you to 
run searches and reports across data from different sources tat share common fields 
and tags3. Therefore, option B is correct. Another statemen€that describes the CIM is 
that the Knowledge Manager uses the CIM to create knowledge objects, which means 
that the person who is responsible for creating and managing knowledge objects such 
as data models, field aliases, tags and event type Xan use the CIM as a guide to 
make their knowledge objects consistent and cgitipatible with other apps and add- 
ons3. Therefore, option C is correct. Option Bis incorrect because it does not 
describe the CIM but rather one of its components. 


$ 


62.Data model fields can be added Using the Auto-Extracted method. 

Which of the following statemems describe Auto-Extracted fields? (select all that 
apply) Poy 

A. Auto-Extracted fields be hidden in Pivot. 

B. Auto-Extracted fields can have their data type changed. 

C. Auto-Extracted figids can be given a friendly name for use in Pivot. 

D. Auto-Extracted’tields can be added if they already exist in the dataset with 
constraints. 

Answer: ABCD 

Explanation: 

Data model fields are fields that describe the attributes of a dataset in a data model2. 
Data model fields can be added using various methods such as Auto-Extracted, 
Evaluated or Lookup2. Auto-Extracted fields are fields that are automatically extracted 
from your raw data using various techniques such as regular expressions, delimiters 
or key-value pairs2. Auto-Extracted fields can be hidden in Pivot, which means that 
you can choose whether to display them or not in the Pivot interface2. Therefore, 
option A is correct. Auto-Extracted fields can have their data type changed, which 
means that you can specify whether they are strings, numbers, booleans or 


timestamps2. Therefore, option B is correct. Auto-Extracted fields can be givena 
friendly name for use in Pivot, which means that you can assign an alternative name 
to them that is more descriptive or user-friendly than the original field name2. 
Therefore, option C is correct. Auto-Extracted fields can be added if they already exist 
in the dataset with constraints, which means that you can include them in your data 
model even if they are already extracted from your raw data by applying filters or 
constraints to limit the scope of your dataset2. Therefore, option D is correct. 


63.When creating a Search workflow action, which field is required? 
A. Search string 

B. Data model name 

C. Permission setting 


D. An eval statement ve 
Answer: A gf 
Explanation: Ka 


Reference: https://docs.splunk. ea Dociinietealot=plne 3/Knowledge/Setupas 
earchworkflowaction 

A workflow action is a link that appears when you oigan event field value in your 
search results2. A workflow action can open a we age or run another search based 
on the field value2. There are two types of workéow actions: GET and POST2. A GET 
workflow action appends the field value to the®end of a URI and opens it in a web 
browser2. A POST workflow action sends, the field value as part of an HTTP request 
to a web server2. When creating a Seach workflow action, which is a type of GET 
workflow action that runs eee seach based on the field value, the only required 
field is the search string2. The s ath string defines the search that will be run when 
the workflow action is clickedanherefore, option A is correct, while options B, C and 
D are incorrect because theySare not required fields for creating a Search workflow 
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64.Selected fielde’are displayed each event in the search results. 
A. below 


B. interesting fields 

C. other fields 

D. above 

Answer: A 

Explanation: 

Selected fields are fields that you choose to display in your search results by clicking 
on them in the Fields sidebar or by using the fields command2. Selected fields are 
displayed below each event in the search results, along with their values2. Therefore, 
option A is correct, while options B, C and D are incorrect because they are not 
places where selected fields are displayed. 


65.A space is an implied in a search string. 
A. OR 
B. AND 
C. () 
D. NOT 
Answer: B 
Explanation: 
A space is an implied AND in a search string, which means that it acts as a logical 
operator that returns events that match both terms on either side of the space2. For 
example, status=200 method=GET will return events that have both status=200 and 
method=GET2. Therefore, option B is correct, while options A, C and Bare incorrect 
because they are not implied by a space in a search string. Ss 
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66.Which of the following search control will not re-rerun théSearch? (Select all that 
apply.) rs 
A. zoom out Ag 
B. selecting a bar on the timeline e 
C. deselect R 
D. selecting a range of bars on the timelines oè 
Answer: B, C, D 3? 

oe 

Explanation: ae 
The timeline is a graphical representation of your search results that shows the 
distribution of events over time2. Wei can use the timeline to zoom in or out of a 
specific time range or to selectyone or more bars on the timeline to filter your results 
by that time range2. Howe ef these actions will not re-run the search, but rather 
refine the existing resultggvased on the selected time range2. Therefore, options B, C 
and D are correct, whil¢ option A is incorrect because zooming out will re-run the 
search with a broader time range. 
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67.Highlighted search terms indicate search results in Splunk. 
A.Display as selected fields. 
B.Sorted 
C.Charted based on time 
D.Matching 
Answer: D 
Explanation: 


Highlighted search terms indicate matching search results in Splunk, which means 
that they show which parts of your events match your search string2. For example, if 
you search for error OR fail, Splunk will highlight error or fail in your events to show 


which events match your search string2. 
Therefore, option D is correct, while options A, B and C are incorrect because they 
are not indicated by highlighted search terms. 


68.When you mouse over and click to add a search term this (thesE. Boolean 
operator(s) is(arE. not implied. (Select all that apply). 


A. OR 

B. () 

C. AND 

D. NOT 

Answer: ABD 

Explanation: a 


When you mouse over and click to add a search term from the Fields°sidebar or from 
an event in your search results, Splunk automatically adds the tenth to your search 
string with an implied AND operator2. However, this does not.apply to some Boolean 
operators such as OR, NOT and parentheses (). These op Stors are not implied 
when you add a search term and you have to type the .anually if you want to use 
them in your search string2. Therefore, options A, B aad D are correct, while option C 
is incorrect because AND is implied when you add a'search term. 
A 
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69.The time range specified for a historicapSearch defines the 
.------ questionable on ans Pe 
A. Amount of data shown on the timetine as data streams in 
B. Amount of data fetched from index matching that time range 
C. Time range for the static reguits 
Answer: B © 
+ 
Explanation: ev 
The time range specified for a historical search defines the amount of data fetched 
from the index matgéiing that time range2. A historical search is a search that runs 
over a fixed period of time in the past2. When you run a historical search, Splunk 
searches the iifdex for events that match your search string and fall within the 
specified time range2. Therefore, option B is correct, while options A and C are 
incorrect because they are not what the time range defines for a historical search. 


70.Using the export function, you can export search results as .( Select 
all that apply) 

A. Xml 

B. Json 

C. Html 

D. A php file 


Answer: A, B 

Explanation: 

Using the export function, you can export search results as XML or JSON2. The 
export function allows you to save your search results in a structured format that can 
be used by other applications or tools2. You can use the output_mode parameter to 
specify whether you want to export your results as XML or JSON2. Therefore, options 
A and B are correct, while options C and D are incorrect because they are not formats 
that you can export your search results as. 


71.The fields sidebar does not show . (Select all that apply.) 
A. interesting fields 
B. selected fields 


CÀ 
C. all extracted fields ve 
Answer: C gf 
Explanation: O° 
X 


The fields sidebar is a panel that shows the fields that are present in your search 
results2. The fields sidebar does not show all extracted fidlds, which are fields that 
are extracted from your raw data using various methe@s such as regular expressions, 
delimiters or key-value pairs2. The fields sidebar Ay shows selected fields and 
interesting fields2. Selected fields are fields thakekyou choose to display in your search 
results by clicking on them in the fields sidekat or by using the fields command2. 
Interesting fields are fields that appear in gfleast 20 percent of events or have high 
variability among values2. Therefore, Qption C is correct, while options A and B are 
incorrect because they are types of fields that the fields sidebar does show. 
<f 
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72.Splunk alerts can be based on search that run . (Select all that apply.) 
A. in real-time A 
B. on a regular schedule 
C. and have no matéhing events 
Answer: A,B „2? 
Explanation: Ê 

plana 

Splunk alerts can be based on searches that run in real-time or on a regular 
schedule3. An alert is a way to monitor your data and get notified when certain 
conditions are met3. You can create an alert by specifying a search and a triggering 
condition3. You can also specify how often you want to run the search and how you 
want to receive the alert notifications3. You can run the alert search in real-time, 
which means that it continuously monitors your data as it streams into Splunks. 
Alternatively, you can run the alert search on a regular schedule, which means that it 
runs at fixed intervals such as every hour or every day3. Therefore, options A and B 
are correct, while option C is incorrect because it is not a way to run an alert search. 


73.Which of the following about reports is/are true? 
A. Reports are knowledge objects. 
B. Reports can be scheduled. 
C. Reports can run a script. 
D. All of the above. 
Answer: D 
Explanation: 
A report is a way to save a search and its results in a format that you can reuse and 
share with others2. A report is also a type of Knowledge object, which is an entity that 
you create to add knowledge to your data and make it easier to search and analyzed. 
Therefore, option A is correct. A report can be scheduled, which means that you can 
configure it to run at regular intervals and send the results to yourself ọĮ others via 
email or other methods2. Therefore, option B is correct. A report c fun a script, 
which means that you can specify a script file to execute when the’report runs and 
use it to perform custom actions or integrations2. Therefore, aption C is correct. 
Therefore, option D is correct because all of the above statéMents are true for 
reports. $ 
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74.Select this in the fields sidebar to automaticatly pipe you search results to the rare 
command 


x2 

A. events with this field g 
B. rare values a 
C. top values by time Pa 
D. top values oad 
Answer: B A 

c 

N 


Explanation: € 

The fields sidebar is a pagtél that shows the fields that are present in your search 
results2. The fields sidébar has two sections: selected fields and interesting fields2. 
Selected fields arefislds that you choose to display in your search results by clicking 
on them in the figids sidebar or by using the fields commandz2. Interesting fields are 
fields that appéar in at least 20 percent of events or have high variability among 
values2. For each field in the fields sidebar, you can select one of the following 
options: events with this field, rare values, top values by time or top values2. If you 
select rare values, Splunk will automatically pipe your search results to the rare 
command, which shows the least common values of a field2. Therefore, option B is 
correct, while options A, C and D are incorrect because they do not pipe your search 
results to the rare command. 


75.A report scheduled to run every 15 mins. but takes 17 mins. to complete is in 
danger of being 


A. skipped or deferred 

B. automatically accelerated 

C. deleted 

D. all of the above 

Answer: A 

Explanation: 

A report that is scheduled to run every 15 minutes but takes 17 minutes to complete is 
in danger of being skipped or deferred2. This means that Splunk may skip some 
scheduled runs of the report if they overlap with previous runs that are still in progress 
or defer them until the previous runs are finished2. This can affect the accuracy and 
timeliness of the report results and notifications2. Therefore, option A is correct, while 
options B, C and D are incorrect because they are not consequences of a report 


taking longer than its schedule interval. 5 
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76.Which of the following are valid options to speed up reports? (Select all the apply.) 
A. Edit permissions a 
B. Edit description Ps 
C. Edit acceleration Ag 
D. Edit schedule E 
Answer: C gK 
Explanation: > 


© 
One of the valid options to speed up repo ‘is to edit acceleration, which means that 
you can enable summary indexing or data model acceleration for your reports to 
improve their . 
performance2. Summary indexing@llows you to create reports that run over large 
amounts of data by storing thegesults of scheduled searches in a summary index and 
using that index for faster reporting2. Data model acceleration allows you to create 
reports that use data ah a creating and storing summaries of the data model 
datasets and using them for faster reporting2. Therefore, option C is correct, while 


options A, B and Dare incorrect because they are not options to speed up reports. 
O 
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77.Which of the following statements are true for this search? (Select all that apply.) 
SEARCH: sourcetype=access” |fields action productlid status 
A. is looking for all events that include the search terms: fields AND action AND 
productld AND status 
B. users the table command to improve performance 
C. limits the fields are extracted 
D. returns a table with 3 columns 
Answer: C 


78.Use the dedup command to 

A. Rename a field in the index 

B. remove duplicate values 

C. provide an additional alias for the field that can 
D. be used in the search criteria 

Answer: B 


79.We can use the rename command to (Select all that apply.) 
A. Change indexed fields 

B. Exclude fields from our search results 

C. Extract new fields from our data using regular expressions 

D. Give a field a new name at search time 

Answer: D RY 


80.The limit attribute will oe 
A. override default of 10 > 
B. only work with top command AZ 

C. override default of 20 N 
D. override default of 15 ev 
Answer: A > 
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